📅 Updated: June 7, 2026 (Originally published: December 30, 2018)
nginx-amplify-agent and the F5 cloud endpoint. For a drop-in replacement that keeps your existing agent working with a single config-line change, see GetPageSpeed Amplify: the drop-in NGINX Amplify replacement.With the great NGINX Amplify service, you may be getting the issue of its agent not being able to read LetsEncrypt SSL certificates which were configured in NGINX.
The main symptom is that you cannot see certificate details in Config analysis of Amplify, and there is this error instead:
OSError: Permission denied
The fix
Reason of the issue is that the Amplify agent runs under non-privileged user (typically, nginx) but LetsEncrypt certificates are owned by root.
NGINX itself has no issue reading those certificates because they are loaded by the NGINX master process, which is run by root as well.
So our fix would be to allow LetsEncrypt certificates to be read by nginx user as well:
setfacl --recursive --modify u:nginx:rX,d:u:nginx:rX
/etc/letsencrypt/archive
/etc/letsencrypt/live
Now you can restart Amplify agent’s service so it can re-read your certificates.
Did you think it would be more complicated? 😀